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Abstract. We present several results on quantum codes over general alphabets 
(that is, in which the fundamental units may have more than 2 states). In particular, 
we consider codes derived from finite symplectic geometry assumed to have additional 
global symmetries. From this standpoint, the analogues of Calderbank-Shor-Steane 
codes and of GF(4)-linear codes turn out to be special cases of the same construction. 
This allows us to construct families of quantum codes from certain codes over number 
fields; in particular, we get analogues of quadratic residue codes, including a single- 
error correcting code encoding one letter in five, for any alphabet size. We also 
consider the problem of fault-tolerant computation through such codes, generalizing 
ideas of Gottcsman. 



Introduction 

Most of the work to date on quantum error correcting codes has concentrated 
on binary codes, both because this is the simplest case, and because such codes 
are likely to be the most useful. However, there are some applications for which 
nonbiliary QECCs would be more useful (e.g., for proof-of-concept implementation 
in certain ion trap models (R. Laflamme, personal communication)). Also, codes 
over alphabets of size 2 l could be useful for constructing easily dccodablc binary 
codes, via concatenation. Finally, regardless of any practical interest, nonbinary 
codes are likely to be of considerable theoretical interest, just as in classical coding 
theory. Thus the present work, which admittedly is more a collection of loosely- 
related results than any sort of attempt at a complete theory of nonbinary quantum 
codes. 

The most successful technique to date for constructing binary quantum codes 
is the additive or stabilizer construction ([2]). This construction takes a classical 
binary code, self-orthogonal under a certain symplectic inner product, and pro- 
duces a quantum code, with minimum distance determined from the classical code. 
This technique readily extends to nonbinary codes; indeed, most of the necessary 
machinery has already been discussed in [1]; we sketch the construction below. 

The most useful and interesting classical nonbinary codes are the MDS codes, 
that is codes that meet the Singleton bound. We therefore give the quantum ana- 
logue of the Singleton bound (already proved for binary alphabets in [5]), allow- 
ing us to define quantum MDS codes. One interesting feature of the theory of 
quantum MDS codes that is absent in the classical theory is the requirement of 
self-orthogonality; this means, in particular, that the existence of an MDS code of 
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length n and minimum distance d need not imply the existence of MDS codes of any 
smaller length with that minimum distance. Thus it no longer suffices to consider 
the largest possible length. Sometimes, however, one can safely shorten a quantum 
MDS code; indeed, associated to any such (symplectic) code, we construct a clas- 
sical code, the codewords of which correspond to different valid shortenings. This 
construction applies to other codes as well, even those that are not self-orthogonal. 

In [2], the problem of constructing symplcctic-self-orthogonal binary codes was 
converted into a problem of constructing additive, Hermitian-self-orthogonal codes 
over GF(4); among other things, this allowed one to consider codes linear over 
GF(4). Unfortunately, the notion of additive codes does not seem to usefully ex- 
tend to larger alphabets (in part since it is difficult to derive symplectic forms 
from symmetric forms in characteristic other than 2); it is somewhat surprising, 
therefore, that the concept of GF(4)-linear codes does usefully extend. This exten- 
sion works by considering codes having certain global symmetries; codes that are 
invariant under an algebra isomorphic to GF(p 2 ) give the desired extension. We 
also get analogues of Calderbank-Shor-Steane codes ([3], [7]) by asserting invariance 
under an algebra isomorphic to GF(p) x GF(p). This allows us, in principle, to 
define classes of codes for varying p by taking a code over a quadratic number field 
and reducing modulo different primes. As an example, we get quantum quadratic 
residue codes, including, for each p, a ((5,p, 3)) p . We also consider the problem 
of fault-toleration operations (using the ideas in [4]); in particular, we show how 
the algebra under which a code is globally invariant extends the possibilities for 
fault-tolerant operation. 

A quick comment on notation: We use the notation ((n, K, d)) a to refer to a 
quantum code that encodes K states in n letters from an alphabet of size a, with 
minimum distance d. In particular, such a code can be used to correct [(d — 1)/2J 
single-letter errors. 



In the case p = 2, the framework of [2] can be used to construct quantum codes 
from codes over GF(2) that are self-orthogonal under a suitable symplectic inner 
product. This generalizes easily to the case p > 2. 

Consider the GF(p)-vector space V n = (GF(p) x GF(p)) n . If we write v G V n as 



we can define the weight of v as the number of i such that at least one of v\ and 

(2) 

f 4 is nonzero. We also have a natural symplectic inner product on V n , given by 



Definition. Let C be a k- dimensional subspace of V n , self-orthogonal under the 
symplectic inner product. If the minimum weight of C 1 - — C is at least d, then we 
say C is an [[n,k,d]] p . If d' is the minimum weight of the nonzero elements of C , 
then we say C is pure to weight d! . If d' > d, then we say C is pure. 



Symplectic codes 




l<i<n 



The relevance of this definition is the following fact: 
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Theorem 1. If there exists an [[n, k,d\] p , then there exists an ((n,p k ,d)) p . If the 
[[n,k,d\] p is pure, then so is the ((n,p k ,d)) p . 

Proof. This is completely analogous to the construction in [2]; see also [1] for a 
discussion of the connections between finite symplcctic geometry and extraspecial 
groups for p > 2. □ 

Let G„ be the natural semidirect product of S n and Sp 2 (p) n . Clearly G n acts 
on V n (Sp 2 (p) n acts coordinate- wise, while S n acts by permuting the coordinates), 
preserving the weight and the inner product. Thus G n acts on symplcctic codes; 
two codes are defined to be equivalent if they are in the same G„-orbit. And the 
automorphism group of a code is given by the subgroup of G n that preserves the 
code. 



Quantum MDS codes 

When using the above theory to construct codes, it is useful to know what to 
shoot for. In classical coding theory, the most useful large-alphabet codes tend to 
be the MDS codes; that is, those codes that meet the Singleton bound. We thus 
consider the quantum analogue: 

Theorem 2 (Quantum Singleton bound). Let C be a ((n,K,d)) a with K > 1. 
Then 

K < a n - 2d + 2 . 

If equality holds, then C is pure to weight n — d + 2. Similarly, a pure ((n, 1, d)) a 
satisfies 2d < n + 2. 

Proof. We use the unitary weight enumerator A'(x, y) ([6]). If 2d > n + 2, then we 
have both A' n _ d+1 = KA' d _ 1 and A' d _ 1 = KA' n _ d+1 , a contradiction for K > 1; 
assume, therefore, that 2d < n + 2, and consider A' n _ d+1 On the one hand, this can 
be written as a linear combination of Bi for < i < d — 1: 



0<i<d-l 



On the other hand, this can be written as a linear combination of A, for < i < 
n-d+1: 

A' n _ d+1 =a-^ (ri) (a - i)% - 

0<i<n-d+l ^ ' 

Since C has minimum distance d, it follows that Bi = K~ 1 A. i for < i < d — 1. 
Consequently, 



— A n _ d+1 A n _ d+1 



= a- n+d - 



1 E 

0<i<n-d+l 



n — I 
d-1 



(a - iyAi 
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Consider the coefficient of Ai, for < i < d — 1 . This is 

For if > a n ~ 2d+2 and K > 1, this is positive, except in the case i = and 
if = a"~ 2d+2 . The result for K > 1 and 2d < n + 2 follows immediately. 

For if = 1, note that A\ = (."J (a - l) f for < i < d - 1. If 2d > n + 2, then 
A'n-d+i = ^-'d-i gi yes a contradiction. □ 

Remark. The bound part of this result was proved for alphabet size 2, using an 
essentially equivalent proof, in [5]; the purity result is apparently new, however. 

A quantum MDS code is defined as a ((n, K, d)) a for which equality holds in 
the quantum Singleton bound; that is, K = a n ~ 2d+2 . Two fairly trivial examples 
of quantum MDS codes are trivial codes (which have parameters ((n, n, 1)) Q ), and 
certain codes of distance 2 (with some restrictions on n; for instance, over a bi- 
nary alphabet, n must be even). We will also see below that a ((5, a, 3)) a and a 
((6, 1,4))q, exist over all alphabets. For binary codes, these are essentially the only 
examples, as remarked in [2]; however, larger alphabets typically have more exam- 
ples as well. The hope is that by concatenating an MDS code over a reasonably 
large alphabet with a suitable binary code, we can construct good codes that are 
still relatively easy to decode, just as in classical coding theory. 

Puncture codes 

The classical theory of MDS codes is greatly simplified by the fact that if an 
MDS code with minimum distance d exists for length n, one can construct MDS 
codes with the same minimum distance for all lengths n' with d < n' < n. Thus, 
in the classical setting, one may restrict ones attention to MDS codes of maximum 
length. The same, however, is no longer true in the quantum setting; the main 
difficulty is that self-orthogonality must be maintained. However, much of the time 
one can, indeed, shorten a symplectic quantum MDS code. To explore when this 
can be done, we introduce the concept of the puncture code of a symplectic code; 
each codeword in the puncture code specifies a construction of a self-orthogonal 
code (possibly shorter). 

Let C be a subspace of (GF(p) x GF(p))™, not necessarily self-orthogonal of 
length n and size p k , such that C ± has minimum distance d. For every pair v and 
w of codewords of C, we define a vector in G¥(p) n by taking the componentwise 
inner product of v and w; that is, if v = {vi,v 2 , ■ ■ -v n ), and w = (w\,W2, ■ ■ - w n ), 
then the new vector is 

{v,w} = ((«i,wi), {v 2 ,w 2 ), ■ ■ ■ (v n ,w n )). 

We define the puncture code P(C) of C as the dual (under the usual inner product 
on GF(p) n ) of the code generated by {v, w} for all v,w € C. 

Theorem 3. If there exists a codeword in P(C) of weight r, then there exists a 
pure [[r, r — k' , d]] p , for some k' < k. 

Proof. We first note that if we apply a transformation of determinant a to some 
column of C, that this has the effect of multiplying that column of P(C) by a -1 . 
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In particular, therefore, we may assume that the codeword we are given is of the 
form </> — (l r ,0"~ r ). Define a new code C by removing all but the first r columns 
from a generator matrix for C; let ir be the natural map from C to C. Clearly, C 
has length r and size at most p k ; also, C is self-orthogonal, since for v,w C C, 



It remains only to show that C has minimum distance at least d. But for any 
codeword w in C /J ", the word (w, 0™~ r ) must be in C x ; it follows immediately that 
w has weight at least d. □ 

Remark. If C is linear (see below), then we can define P(C) much more simply 
as the code spanned by the componentwise norms of the vectors in C; in particular, 
in the case p — 2, C inert linear, this is the binary code generated by the supports 
of the vectors in C (theorem 7 in [2]). 

One possible application of this theory would be construction of analogues for 
large alphabets of the binary quantum Hamming codes. Unfortunately, the naive 
construction gives a code that is not itself self-orthogonal. However, in all cases the 
author has checked, P(C) contains a vector of full weight, allowing the construction 
of a quantum code with the desired parameters. See also the entries marked "S" 
in table III of [2] , for applications of puncture codes in the binary case. 



For p = 2, there are two special cases of particular interest; Calderbank-Shor- 
Steane codes ([3], [7]) and GF(4)-linear codes ([2]). Both of these generalize nat- 
urally to p > 2. Essentially, one can characterize both cases in terms of certain 
global symmetries. 

Consider the group Sp 2 (p). This acts on symplectic codes, by applying the same 
transformation to each coordinate. Then, let G be a subgroup of Sp 2 (p); we wish 
to characterize those symplectic codes preserved by G. Clearly, this depends only 
on the algebra A spanned by G; this suggests that we should instead consider sym- 
plectic codes invariant under some subalgebra of the algebra spanned by Sp 2 (p). 
In particular, since the algebra spanned by Sp 2 (p) is Mat 2 (p), we conclude imme- 
diately that A has dimension 1, 2, or 4. The first case is trivial: any code must be 
invariant under GF(p), simply by GF(p)-linearity. The last case can be handled by 
noting that every 2-dimensional subalgebra of A must preserve the code; we will 
thus postpone that case until later. 

It remains to consider the case dim(A) = 2. In this case, we can write the generic 
element of A as a + bX, for some fixed X € Mat 2 (p), not a multiple of the identity. 
Clearly, we care only about the orbit of X under conjugation by Sp 2 (p) = SL 2 (p). 
Thus, let us choose a basis for GF(p) x GF(p) in such a way that 



(7I"(l>), Tr(w)} = <fi ' {v, UNI- 



LINEAR CODES 




This gives us an isomorphism (of vector spaces, not of algebras) between A and 
GF(p) x GF(p), given by a + bX ^ (a, b). 
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Theorem 4. A subs-pace of (GF(p) x GF(p))™ invariant under A is self-orthogonal 
if and only if the corresponding A-submodule of A n is self-orthogonal under the 
A-valued inner product 

(v,w) A =v-w, 

where X = t — X . 

Proof. Let v = a\ + b\X and w = a 2 + b 2 X . Then 

vw = (— a\b 2 + bia 2 )X + aia 2 + aib 2 t + b\b 2 d = —(v, w)X + (v, wX). 
The theorem follows. □ 

Corollary 5. If there exists an A-submodule C of A n self-orthogonal under the 
inner product v ■ w, of size p k , such that the minimum Hamming weight of C^ — C 
is d, then there exists a [[n, n — k, d]] p . 

We will call such a symplectic code A-linear. The overall structure of A-linear 
codes clearly depends only on the orbit of A under conjugation by Sp 2 (p). In par- 
ticular, there are precisely three cases, depending on whether t 2 — Ad is a nonsquare, 
a nonzero square, or 0; we will use the terminology inert linear, split linear, or ram- 
ified linear respectively. If t 2 — 4d is a nonsquare, then A is isomorphic to the finite 
field GF(p 2 ); this clearly corresponds to GF(4)-linear codes for p = 2. 

In the split linear case, we may, without loss of generality, assume that X has 
characteristic polynomial x 2 — x, and thus X(l — X) = 0. It follows that C is the 
direct sum of CX and C(l — X). But then there exist unique codes C\ and C 2 
in GF(p) n such that CX = CiX and C(l - X) = C 2 (l - X). This gives us the 
analogue of Calderbank-Shor-Steane codes: 

Theorem 6. Let C be a split linear code, with associated GF(p)-codes C\ and C 2 . 
Then Ci C C 2 , and the minimum distance of C is given by the minimum of the 
minimum weights of C 2 — C\ and — C 2 . Conversely, any pair of codes C\ and 
C 2 with C\ C C 2 give rise to a split linear code. 

Proof. The generic element of C can be written as v\X + v 2 (l — X). The inner 
product of two such elements is 

( Vl X + v 2 (l - X)) ■ ( Wl X + w 2 (l - X)) 

= ( Vl X + v 2 (l - X)) ■ ( Wl (l -X) + w 2 X) 
= ( Wl • w 2 )X 2 + (v 2 ■ wi)(l - X) 2 
= (v\ ■ w 2 — V 2 • W\)X + (v 2 ■ Wi). 

Consequently, C is self-orthogonal if and only if v\ ■ v 2 for all vi e C\ and v 2 e C 2 . 
The statement about the minimum distance of the corresponding quantum code 
follows analogously. □ 

Finally, we have the ramified linear case; in this case, X has minimal polynomial 
X 2 without loss of generality. As in the split linear case, we have an associated 
code C\ over GF(p), such that C\X — CX. We also have an associated code Co 
given by those elements such that vX — 0; note that Co must contain C±, since C 
contains C\X. To complete the specification of C, it remains to give a map 4> from 
Ci to C/Co; for v\ e Ci, <j)(vi) is defined by requiring that v\ + wX G C precisely 
when w G 4>{v\). 
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Lemma 7. Let C be a ramified linear code, with associated GF(p)-codes C\ and Co 
and associated map <j>. Then C\ is orthogonal to Co (and is thus self-orthogonal). 
The minimum distance of the associated quantum code is bounded between the min- 
imum weight of Cq — C\ and the minimum weight of Cj 1 — Co . Conversely, any 
codes C\, Co, and map <f> give rise to a quantum code in this fashion. 

Proof. We compute, as before, 



From the case w\ — 0, wo <E Co, we conclude that C\ is orthogonal to Co- 

Clearly, changing the map to can only decrease the minimum distance; in 
that case, C = C\ + CqX, and C 1 - = Cq + C^X. On the other hand, for any 
element v g Cf - C , vX g C 1 - - C. □ 

Remark. In general, the minimum distance can depend on the map <j>, although 
this does not happen in the pure case (the minimum distance of C 1 - is equal to the 
minimum distance of the kernel of X in C^, that is, C^X). 

It remains only to consider the case dim(A) = 4. In this case, the code is 
certainly split linear; let C\ and Ci be its associated codes. Since A = Mat2(p), 
the linear transformation taking aX + 6(1 — X) to a(l — X) + bX is certainly in A; 
consequently, we must have C\ — Ci. Conversely, if C is a split linear code with 
Ci = C2, then C is Mat2(p)-linear. 

For alphabets of size p l , it makes sense to consider symplectic subalgebras of 
Mat 2 z(p); that is, subalgebras invariant under the transformation 



where J is the symplectic inner product. Then we have a notion of A-linear codes 
as before (codes C such that AC c C). In general, it is not as clear how to work 
with such codes; certain special cases (codes linear over a subalgebra of Mat2(p J )) 
can be dealt with as above, but others are not so straightforward (e.g., codes linear 
over a quaternion algebra). 



Let O = Z[a] be the integer ring of a real quadratic field. Suppose we are given 
a O-submodulc C of O n such that v ■ W = for all v, w g C. Clearly, we can imbed 
O in Mat 2 (Z), by mapping a to 



Reduction mod p then gives us a A-lincar code C p , where A is the reduction of the 
image of O modulo p. This new code is split (resp. inert, ramified) if and only if 
the prime p is split (resp. inert, ramified) in O. One natural question is how the 
minimum distance of C p behaves as p varies. 

Theorem 8. Let d be the maximum over all p of the minimum distance of Cp . 
Then this minimum distance is attained for all but a finite number of p. 

Proof. For each d— 1-set S of columns of C, define an ideal Is as the ideal generated 
by the deterimants of all d — 1 x d — 1 submatrices of the selected columns of the 



(vi + v X) ■ (wi + w X) =vi-wi + (vi ■ w + v ■ wi)X. 



T = J- x T l J, 



Codes from number fields 
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generator matrix of C. We readily see that there exists a codeword of Cp with 
support contained in S if and only if Is is not relatively prime to p. Thus, if we 
define Id-i as the least common multiple of the ideals Is, then Cp has minimum 
distance d precisely when i^-i is relatively prime to p. Unless i^-i = 0, this fails 
only a finite number of times (for those primes dividing the norm of Id-i)- But by 
assumption there exists at least one prime p' such that Cp has minimum distance 
d, so Id-i must be nontrivial. □ 

As an example of the use of this theory, we define quantum quadratic-residue 
codes. Let p' be a prime congruent to 1 modulo 4, and consider the integer ring 
O = Z[6 'p'\, where 

V = — 2~ • 
Over O, the polynomial x p — 1 factors as 



(x — l)u(x)v(x), 
for some v{x) of degree (p' — l)/2. Then the polynomial 

(x — \)v{x) 

determines a cyclic O-module C of rank {p' — l)/2. 
Theorem 9. For all v,w e C, 

v • w = 0. 

Proof. Let and w{x) be the corresponding polynomials in 

0[x}/(x p ' - 1). 
Then v ■ w can be computed as the x° coefficient of 



v(x)w(x p ' 1 ). 

In particular, since v and w are in C, both can be written as multiples of (x — l)v{x). 
But 

vixP'- 1 ) = u(x), 



since —1 is a quadratic residue modulo p' . It follows that v(x)w(x p ' ~ x ) is a multiple 
of (x — \)i>(x)v{x), so must be 0. □ 

Thus for all p, C p produces a [[n, 1, for some d(p). The case p — p' is of 

particular interest: 

Theorem 10. C p i is a pure [[n, 1, ^(p' + l)]] p ; in particular, it is MDS. 

Proof. By the remark after lemma 5, it suffices to show that y/j/Cp' has minimum 
dual distance \{p' + 1); equivalently, we need to show that the code (C p > mod VP 7 ) 
is MDS. But, in fact, any classical cyclic code of length equal to its characteristic 
is MDS. □ 
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Corollary 11. For all but a finite number of primes p, C p is MDS. 
Proof. Apply theorem 8 to C. □ 

Corollary 12. For all but a finite number of primes p, C p can be extended to a 
self-dual MDS code of length p' + 1. 

Proof. Let p be any prime such that C p is MDS. By theorem 2, C p is pure to weight 
But then theorem 20 of [6] allows us to construct the desired self-dual MDS 
code of length p' + 1 and minimum distance ^-j^ . □ 

Consider, for example, the case p' = 5. In this direct computation readily 

shows that the ideal h as defined in theorem 8 is (1); consequently, 

Theorem 13. For all integers a > 1, there exists a ((5, a,3)) a and a ((6, 1,4)) Q . 

Proof. For prime a, we are done; for composite a, simply take the direct sum of 
the codes corresponding to the prime factors of a. □ 

Universal fault-tolerant operations 

In [4], Gottesman gives a method for doing fault-tolerant operations through 
quantum codes using automorphisms of the code and of certain related codes. In 
particular, he gives a quaternary operation that can be applied fault-tolerantly 
through any additive code. It is natural to wonder how this extends to codes over 
larger alphabets, and to what extent existing symmetries of the code can be used 
to extend the set of operations. 

In particular, fix a prime p, an integer I > 1, and a symplectic subalgcbra A 
of Mat2;(GF(p)); wc would like to characterize all fault-tolerant operations that 
are universal for A-linear codes. That is, we would like to determine all elements 
of Sp 2 ; m (GF(p)) that are global automorphisms of for all A-linear Q, where 
is the direct sum of m copies of C, viewed as a symplectic code over GF(p) lm . 
Clearly, it suffices to consider the corresponding subalgebra of Mat2/m(GF(p)). 

Theorem 14. Let C be an A-linear code. Then is Ma,t m (A)-linear. Con- 

versely, if T S Mat22m(GF(j>)) is not in Mat m (A), then there exists an A-linear 
code C such that C^ m ^ is not T -invariant. 

Proof. Let T be an element of Mat 2 ; TO (GF(p)) such that TQ (m ^> C Q {m) for all bi- 
linear Q. For all v e (GF(p) 2l ) k such that ( v, va) = for all n£4, vA is an A-linear 
code; consequently, we must have T{vA)^ m ^ C (vA)^ for all such v. Conversely, 
if this is true, then T is universal, since any A-linear Q can be written as a union of 
such codes. Now, it follows that T(v, 0, 0, ... 0) = (vi,v 2 , Vs, . . . v m ), where each Vi 
must be in vA. By choosing k sufficiently large, we may insist that the coefficients 
of v form a basis of GF(p) 2lm ; it follows that there must exist elements an, ai2, 
. . . ai m such that for all v, 

T(v,0, 0, . . .0) = {vau,vai2, ■ ..vai m ). 

It follows that T can be written as an element of Mat m (A). Clearly, any such T 
will take (vA)^ to a subspace of {vA)^ m \ so the desired algebra is Mat m (A). □ 

It remains only to determine which of these operations preserve the inner product 
(and thus correspond to operations that can be physically performed). Considered 
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as an element of Mat2; m (GF(p)), T must satisfy TJT* = J, where J is the sym- 
plectic inner product. Equivalently, JT* J -1 must be T^ 1 . Considering T as and 
element of Mat m (A), this says that T'T = 1, where T' is the conjugate of the 
transpose of T. 

Of particular interest are those operations that cannot be decomposed as a prod- 
uct of unary operations and permutations; that is, those elements T which are not 
monomial matrices over A. 

Example 1. Let A = GF(p'); in particular, if I = 1, this includes all symplectic 
codes. Then for T £ Mat m (A), T = T, so we get the group O m (GF(p 1 )). For 
p l = 2, the first non-monomial operation appears when m = 4. This is, for instance, 
given by 

/0 1 1 1\ 

10 11 

110 1' 
Vl 1 1 0/ 

this is equivalent to equation (45) in [4]. For p = 2, I > 1, we always have non- 
monomial operations of the following form: 

f l + x x \ 
^ x l+x) ' 

where x is any element of GF(p') — GF(p); it is not clear, however, whether these 
can be used to perform fault-tolerant operations. 

Example 2. Let A = GF(p 21 ). This is readily seen to correspond to the unitary 
group U m (GF(p 21 )). For p l — 2, we first see non-monomial operations when m = 3; 
for instance, 

1 1 1\ 

1 LU LU . 
1 U UJ J 

Note that the operation given as equation (40) in [4] as fault-tolerant for the well- 
known [[5, 1, 3]] is unitary, so can be applied to any GF(4)-linear binary code. 

Example 3. Let A = GF(p l ) x GF(p l ) (i.e., Calderbank-Shor-Steane). Any element 
of Mat m (A) can be written as a pair of elements of Mat m (GF(p ; )); conjugation 
switches these elements. Thus the fault-tolerant operations are those of the form 
(Ti,T 2 ), where T[T 2 = 1. This is equivalent to the group GL m (GF(p ; )). We first 
see non-monomial operations when m = 2; for instance, when p l — 2, we get 

(" !)■ 

which corresponds to a controlled- not. 
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